# -*- coding: utf-8 -*-
import sys
reload(sys)
sys.setdefaultencoding('utf-8')
import json

# 这段代码可以把volatility生成的什么说明都没有,只有一个值的json文件,和每个值具体代表什么对应上

with open("/home/sam/blender/script/memory_layout/vad/vadtree.json","r") as f:
	data = json.load(f)
	f.close()
data = data["rows"]
head = ['pid', 'vad', 'start', 'end', 'VadTag', 'flags', 'protection', 'VadType', 'ControlArea', 'segment', \
       'NumberOfSectionReferences', 'NumberOfPfnReferences', 'NumberOfMappedViews', 'NumberOfUserReferences',\
       'ControlFlags', 'FileObject', 'FileName', 'FirstprototypePTE', 'LastcontiguousPTE', 'Flags2']
result = dict()
for vad_item in data:
	temp = dict(zip(head,vad_item))
	if not result.has_key(temp["pid"]):
		result[temp["pid"]] = list()
		# result[temp["pid"]].append(0) # 不知道加个0在这干嘛,第一行数据非要是个数字,可能他们有特殊需要呢?
	# if temp["FileName"][-4:] == ".exe":
	# 	result[temp["pid"]][0] = temp["FileObject"]
	result[temp["pid"]].append(temp)
with open("/home/sam/blender/script/memory_layout/vad/vadtree_result.json","w") as f:
	f.write(json.dumps(result))
	f.close()

# import pefile
# pe = pefile.PE("/home/sam/blender/vad/vadtree_result.json")
# info_dict = pe.dump_dict("all")
# with open("/home/sam/blender/vad/vadtree_result2.json","w") as fp:
# 	fp.write(json.dumps(info_dict))
